analysis_bf.c File Reference

#include <string.h>
#include <rz_types.h>
#include <rz_lib.h>
#include <rz_asm.h>
#include <rz_analysis.h>

Go to the source code of this file.

Macros
#define	BF_ADDR_MEM   0x10000
#define	BF_ADDR_SIZE   64
#define	BF_BYTE_SIZE   8
#define	BF_ID_STACK   32
#define	bf_il_ptr()   rz_il_op_new_var("ptr", RZ_IL_VAR_KIND_GLOBAL)
#define	bf_il_set_ptr(x)   rz_il_op_new_set("ptr", false, x)
#define	bf_il_one(l)   rz_il_op_new_bitv_from_ut64(l, 1)

Functions
static int	getid (char ch)
static void	bf_syscall_read (RzILVM *vm, RzILOpEffect *op)
static void	bf_syscall_write (RzILVM *vm, RzILOpEffect *op)
RzILOpEffect *	bf_right_arrow ()
RzILOpEffect *	bf_left_arrow ()
RzILOpEffect *	bf_inc ()
RzILOpEffect *	bf_dec ()
RzILOpEffect *	bf_out ()
RzILOpEffect *	bf_in ()
static ut64	find_matching_bracket (RzAnalysis *analysis, ut64 addr, int dir)
RzILOpEffect *	bf_llimit (RzAnalysis *analysis, ut64 addr, ut64 target)
RzILOpEffect *	bf_rlimit (RzAnalysis *analysis, ut64 addr, ut64 target)
static RzAnalysisILConfig *	il_config (RzAnalysis *analysis)
static int	bf_op (RzAnalysis *analysis, RzAnalysisOp *op, ut64 addr, const ut8 *buf, int len, RzAnalysisOpMask mask)
static char *	get_reg_profile (RzAnalysis *analysis)

Variables
RzAnalysisPlugin	rz_analysis_plugin_bf
RZ_API RzLibStruct	rizin_plugin

Macro Definition Documentation

BF_ADDR_MEM

#define BF_ADDR_MEM   0x10000

Definition at line 18 of file analysis_bf.c.

BF_ADDR_SIZE

#define BF_ADDR_SIZE   64

Definition at line 19 of file analysis_bf.c.

BF_BYTE_SIZE

#define BF_BYTE_SIZE   8

Definition at line 20 of file analysis_bf.c.

BF_ID_STACK

#define BF_ID_STACK   32

Definition at line 21 of file analysis_bf.c.

bf_il_one

#define bf_il_one

(

l

)

rz_il_op_new_bitv_from_ut64(l, 1)

Definition at line 25 of file analysis_bf.c.

bf_il_ptr

#define bf_il_ptr

(

)

rz_il_op_new_var("ptr", RZ_IL_VAR_KIND_GLOBAL)

Definition at line 23 of file analysis_bf.c.

bf_il_set_ptr

#define bf_il_set_ptr

(

x

)

rz_il_op_new_set("ptr", false, x)

Definition at line 24 of file analysis_bf.c.

Function Documentation

bf_dec()

RzILOpEffect* bf_dec

(

)

Definition at line 74 of file analysis_bf.c.

                       {
    // (store mem (var ptr) (- (load (var ptr)) (int 1)))
    // mem == 0 because is the only mem in bf
    RzILOpBitVector *load = rz_il_op_new_load(0, bf_il_ptr());
    RzILOpBitVector *sub = rz_il_op_new_sub(load, bf_il_one(BF_BYTE_SIZE));
    return rz_il_op_new_store(0, bf_il_ptr(), sub);
}

References BF_BYTE_SIZE, bf_il_one, bf_il_ptr, load(), rz_il_op_new_load(), rz_il_op_new_store(), and rz_il_op_new_sub().

Referenced by bf_op().

bf_in()

RzILOpEffect* bf_in

(

)

Definition at line 87 of file analysis_bf.c.

                      {
    // (goto hook_read)
    return rz_il_op_new_goto("read");
}

References rz_il_op_new_goto().

Referenced by bf_op().

bf_inc()

RzILOpEffect* bf_inc

(

)

Definition at line 66 of file analysis_bf.c.

                       {
    // (store mem (var ptr) (+ (load (var ptr)) (int 1)))
    // mem == 0 because is the only mem in bf
    RzILOpBitVector *load = rz_il_op_new_load(0, bf_il_ptr());
    RzILOpBitVector *add = rz_il_op_new_add(load, bf_il_one(BF_BYTE_SIZE));
    return rz_il_op_new_store(0, bf_il_ptr(), add);
}

References add(), BF_BYTE_SIZE, bf_il_one, bf_il_ptr, load(), rz_il_op_new_add(), rz_il_op_new_load(), and rz_il_op_new_store().

Referenced by bf_op().

bf_left_arrow()

RzILOpEffect* bf_left_arrow

(

)

Definition at line 60 of file analysis_bf.c.

                              {
    // (set ptr (- (val ptr) (int 1)))
    RzILOpBitVector *sub = rz_il_op_new_sub(bf_il_ptr(), bf_il_one(BF_ADDR_SIZE));
    return bf_il_set_ptr(sub);
}

References BF_ADDR_SIZE, bf_il_one, bf_il_ptr, bf_il_set_ptr, and rz_il_op_new_sub().

Referenced by bf_op().

bf_llimit()

RzILOpEffect* bf_llimit	(	RzAnalysis *	analysis,
		ut64	addr,
		ut64	target
	)

Definition at line 131 of file analysis_bf.c.

                                                                      {
    // (perform (branch (load mem (var ptr))
    //                  (do nothing)
    //                  (goto ]))
    RzILOpBitVector *var = rz_il_op_new_var("ptr", RZ_IL_VAR_KIND_GLOBAL);
    RzILOpBool *cond = rz_il_op_new_non_zero(rz_il_op_new_load(0, var));
    // goto ]
    RzILOpEffect *jmp = rz_il_op_new_jmp(rz_il_op_new_bitv_from_ut64(64, target));
    // branch if (load mem (var ptr)) is false then goto ]
    return rz_il_op_new_branch(cond, NULL, jmp);
}

References cond, jmp, NULL, rz_il_op_new_bitv_from_ut64(), rz_il_op_new_branch(), rz_il_op_new_jmp(), rz_il_op_new_load(), rz_il_op_new_non_zero(), rz_il_op_new_var(), and RZ_IL_VAR_KIND_GLOBAL.

Referenced by bf_op().

bf_op()

static int bf_op ( RzAnalysis *  analysis, RzAnalysisOp *  op, ut64  addr, const ut8 *  buf, int  len, RzAnalysisOpMask  mask  )

static

Definition at line 173 of file analysis_bf.c.

                                                                                                                    {
    rz_return_val_if_fail(analysis && op, -1);
 
    op->size = 1;
    op->id = getid(buf[0]);
    op->addr = addr;
 
    switch (buf[0]) {
    case '[':
        // Find the jump target, +1 because we jump directly after the matching bracket.
        // If not found this returns UT64_MAX, so this overflows to 0, which is considered the "invalid"
        // value for RzAnalysisOp, so it's fine.
        op->jump = find_matching_bracket(analysis, addr, 1) + 1;
        if (mask & RZ_ANALYSIS_OP_MASK_IL) {
            op->il_op = bf_llimit(analysis, addr, op->jump);
        }
        op->type = RZ_ANALYSIS_OP_TYPE_CJMP;
        op->fail = addr + 1;
        break;
    case ']':
        // same idea for target as above
        op->jump = find_matching_bracket(analysis, addr, -1) + 1;
        if (mask & RZ_ANALYSIS_OP_MASK_IL) {
            op->il_op = bf_rlimit(analysis, addr, op->jump);
        }
        op->type = RZ_ANALYSIS_OP_TYPE_UJMP;
        break;
    case '>':
        op->type = RZ_ANALYSIS_OP_TYPE_ADD;
        if (mask & RZ_ANALYSIS_OP_MASK_IL) {
            op->il_op = bf_right_arrow();
        }
        break;
    case '<':
        op->type = RZ_ANALYSIS_OP_TYPE_SUB;
        if (mask & RZ_ANALYSIS_OP_MASK_IL) {
            op->il_op = bf_left_arrow();
        }
        break;
    case '+':
        op->type = RZ_ANALYSIS_OP_TYPE_ADD;
        if (mask & RZ_ANALYSIS_OP_MASK_IL) {
            op->il_op = bf_inc();
        }
        break;
    case '-':
        op->type = RZ_ANALYSIS_OP_TYPE_SUB;
        if (mask & RZ_ANALYSIS_OP_MASK_IL) {
            op->il_op = bf_dec();
        }
        break;
    case '.':
        if (mask & RZ_ANALYSIS_OP_MASK_IL) {
            op->il_op = bf_out();
        }
        op->type = RZ_ANALYSIS_OP_TYPE_STORE;
        break;
    case ',':
        if (mask & RZ_ANALYSIS_OP_MASK_IL) {
            op->il_op = bf_in();
        }
        op->type = RZ_ANALYSIS_OP_TYPE_LOAD;
        break;
    case 0x00:
    case 0xff:
        op->type = RZ_ANALYSIS_OP_TYPE_TRAP;
        break;
    default:
        op->type = RZ_ANALYSIS_OP_TYPE_NOP;
        if (mask & RZ_ANALYSIS_OP_MASK_IL) {
            op->il_op = rz_il_op_new_nop();
        }
        break;
    }
    return op->size;
}

References addr, bf_dec(), bf_in(), bf_inc(), bf_left_arrow(), bf_llimit(), bf_out(), bf_right_arrow(), bf_rlimit(), find_matching_bracket(), getid(), mask, RZ_ANALYSIS_OP_MASK_IL, RZ_ANALYSIS_OP_TYPE_ADD, RZ_ANALYSIS_OP_TYPE_CJMP, RZ_ANALYSIS_OP_TYPE_LOAD, RZ_ANALYSIS_OP_TYPE_NOP, RZ_ANALYSIS_OP_TYPE_STORE, RZ_ANALYSIS_OP_TYPE_SUB, RZ_ANALYSIS_OP_TYPE_TRAP, RZ_ANALYSIS_OP_TYPE_UJMP, rz_il_op_new_nop(), and rz_return_val_if_fail.

bf_out()

RzILOpEffect* bf_out

(

)

Definition at line 82 of file analysis_bf.c.

                       {
    // (goto write)
    return rz_il_op_new_goto("write");
}

References rz_il_op_new_goto().

Referenced by bf_op().

bf_right_arrow()

RzILOpEffect* bf_right_arrow

(

)

Definition at line 54 of file analysis_bf.c.

                               {
    // (set ptr (+ (val ptr) (int 1)))
    RzILOpBitVector *add = rz_il_op_new_add(bf_il_ptr(), bf_il_one(BF_ADDR_SIZE));
    return bf_il_set_ptr(add);
}

References add(), BF_ADDR_SIZE, bf_il_one, bf_il_ptr, bf_il_set_ptr, and rz_il_op_new_add().

Referenced by bf_op().

bf_rlimit()

RzILOpEffect* bf_rlimit	(	RzAnalysis *	analysis,
		ut64	addr,
		ut64	target
	)

Definition at line 143 of file analysis_bf.c.

                                                                      {
    // (perform (branch (load mem (var ptr))
    //                  (goto [)
    //                  (do nothing))
    RzILOpBitVector *var = rz_il_op_new_var("ptr", RZ_IL_VAR_KIND_GLOBAL);
    RzILOpBool *cond = rz_il_op_new_non_zero(rz_il_op_new_load(0, var));
    // goto [
    RzILOpEffect *jmp = rz_il_op_new_jmp(rz_il_op_new_bitv_from_ut64(64, target));
    // branch if (load mem (var ptr)) is true then goto ]
    RzILOpEffect *branch = rz_il_op_new_branch(cond, jmp, NULL);
    return branch;
}

References test-lz4-speed::branch, cond, jmp, NULL, rz_il_op_new_bitv_from_ut64(), rz_il_op_new_branch(), rz_il_op_new_jmp(), rz_il_op_new_load(), rz_il_op_new_non_zero(), rz_il_op_new_var(), and RZ_IL_VAR_KIND_GLOBAL.

Referenced by bf_op().

bf_syscall_read()

static void bf_syscall_read ( RzILVM *  vm, RzILOpEffect *  op  )

static

Definition at line 27 of file analysis_bf.c.

                                                          {
    ut8 c = getc(stdin);
    RzBitVector *bv = rz_bv_new_from_ut64(BF_BYTE_SIZE, c);
    RzILVal *ptr_val = rz_il_vm_get_var_value(vm, RZ_IL_VAR_KIND_GLOBAL, "ptr");
    if (ptr_val->type == RZ_IL_TYPE_PURE_BITVECTOR) {
        rz_il_vm_mem_store(vm, 0, ptr_val->data.bv, bv);
    } else {
        rz_warn_if_reached();
    }
    rz_bv_free(bv);
}

References BF_BYTE_SIZE, RzValUnion::bv, c, rz_il_val_t::data, rz_bv_free(), rz_bv_new_from_ut64(), RZ_IL_TYPE_PURE_BITVECTOR, RZ_IL_VAR_KIND_GLOBAL, rz_il_vm_get_var_value(), rz_il_vm_mem_store(), rz_warn_if_reached, and rz_il_val_t::type.

Referenced by il_config().

bf_syscall_write()

static void bf_syscall_write ( RzILVM *  vm, RzILOpEffect *  op  )

static

Definition at line 39 of file analysis_bf.c.

                                                           {
    RzILVal *ptr_val = rz_il_vm_get_var_value(vm, RZ_IL_VAR_KIND_GLOBAL, "ptr");
    if (ptr_val->type != RZ_IL_TYPE_PURE_BITVECTOR) {
        rz_warn_if_reached();
        return;
    }
    RzBitVector *bv = rz_il_vm_mem_load(vm, 0, ptr_val->data.bv);
    ut32 c = rz_bv_to_ut32(bv);
    if (c) {
        putchar(c);
        fflush(stdout);
    }
    rz_bv_free(bv);
}

References RzValUnion::bv, c, rz_il_val_t::data, rz_bv_free(), rz_bv_to_ut32(), RZ_IL_TYPE_PURE_BITVECTOR, RZ_IL_VAR_KIND_GLOBAL, rz_il_vm_get_var_value(), rz_il_vm_mem_load(), rz_warn_if_reached, and rz_il_val_t::type.

Referenced by il_config().

find_matching_bracket()

static ut64 find_matching_bracket ( RzAnalysis *  analysis, ut64  addr, int  dir  )

static

Search matching [ or ] starting at addr in direction given by dir (-1 or 1)

Definition at line 95 of file analysis_bf.c.

                                                                            {
    if (!analysis->read_at) {
        return UT64_MAX;
    }
    static const ut64 max_dist = 2048; // some upper bound to avoid (almost) infinite loops
    ut64 dist = 0;
    int lev = dir;
    while (dist < max_dist) {
        dist++;
        addr += dir;
        if (addr == UT64_MAX) {
            break;
        }
        ut8 c;
        analysis->read_at(analysis, addr, &c, 1);
        switch (c) {
        case '[':
            lev++;
            break;
        case ']':
            lev--;
            break;
        case 0:
        case 0xff:
            // invalid code
            return UT64_MAX;
        default:
            continue;
        }
        if (lev == 0) {
            return addr;
        }
    }
    return UT64_MAX;
}

References addr, c, rz_analysis_t::read_at, ut64(), and UT64_MAX.

Referenced by bf_op().

get_reg_profile()

static char* get_reg_profile ( RzAnalysis *  analysis )

static

Definition at line 250 of file analysis_bf.c.

                                                   {
    return strdup(
        "=PC    pc\n"
        "=BP    ptr\n"
        "=SP    ptr\n"
        "=A0    ptr\n"
        "=A1    ptr\n"
        "=A2    ptr\n"
        "=A3    ptr\n"
        "gpr    ptr .64 0   0\n" // data pointer
        "gpr    pc  .64 8   0\n" // program counter
    );
}

References strdup().

getid()

static int getid ( char  ch )

static

Definition at line 11 of file analysis_bf.c.

                          {
    const char *keys = "[]<>+-,.";
    const char *cidx = strchr(keys, ch);
    return cidx ? cidx - keys + 1 : 0;
}

References keys.

Referenced by bf_op().

il_config()

static RzAnalysisILConfig* il_config ( RzAnalysis *  analysis )

static

Definition at line 156 of file analysis_bf.c.

                                                           {
    RzAnalysisILConfig *cfg = rz_analysis_il_config_new(64, false, 64);
    cfg->init_state = rz_analysis_il_init_state_new();
    if (!cfg->init_state) {
        rz_analysis_il_config_free(cfg);
        return NULL;
    }
    rz_analysis_il_init_state_set_var(cfg->init_state, "ptr", rz_il_value_new_bitv(rz_bv_new_from_ut64(64, BF_ADDR_MEM)));
    RzILEffectLabel *read_label = rz_il_effect_label_new("read", EFFECT_LABEL_SYSCALL);
    read_label->hook = bf_syscall_read;
    rz_analysis_il_config_add_label(cfg, read_label);
    RzILEffectLabel *write_label = rz_il_effect_label_new("write", EFFECT_LABEL_HOOK);
    write_label->hook = bf_syscall_write;
    rz_analysis_il_config_add_label(cfg, write_label);
    return cfg;
}

References BF_ADDR_MEM, bf_syscall_read(), bf_syscall_write(), EFFECT_LABEL_HOOK, EFFECT_LABEL_SYSCALL, rz_il_effect_label_t::hook, rz_analysis_il_config_t::init_state, NULL, rz_analysis_il_config_add_label(), rz_analysis_il_config_free(), rz_analysis_il_config_new(), rz_analysis_il_init_state_new(), rz_analysis_il_init_state_set_var(), rz_bv_new_from_ut64(), rz_il_effect_label_new(), and rz_il_value_new_bitv().

Variable Documentation

rizin_plugin

RZ_API RzLibStruct rizin_plugin

Initial value:

= {
    .type = RZ_LIB_TYPE_ANALYSIS,
    .data = &rz_analysis_plugin_bf,
    .version = RZ_VERSION
}

Definition at line 276 of file analysis_bf.c.

rz_analysis_plugin_bf

RzAnalysisPlugin rz_analysis_plugin_bf

Initial value:

= {
    .name = "bf",
    .desc = "brainfuck code analysis plugin",
    .license = "LGPL3",
    .arch = "bf",
    .bits = 64, 
    .op = &bf_op,
    .get_reg_profile = get_reg_profile,
    .il_config = il_config
}

Definition at line 264 of file analysis_bf.c.